1. Field of the Invention
The present invention relates to an in-vehicle electronic control apparatus incorporating a microprocessor and particularly to improvement of an in-vehicle electronic control apparatus, such as an engine control apparatus, which has a monitoring control circuit serially connected to the microprocessor in order to enhance the safety of the control.
2. Description of the Related Art
It is publicly known that, in an in-vehicle electronic control apparatus equipped with a microprocessor, a so-called Q&A-method abnormality determination unit is utilized in which, in order to always monitor whether or not the microprocessor functions normally, a monitoring control circuit unit is provided, the monitoring control circuit transmits question information to the microprocessor that serves as a main control circuit unit, the microprocessor sends the monitoring control circuit unit answer information in response to the question information, and then the monitoring control circuit compares the sent answer information with correct-solution information that has preliminarily been provided and ascertains whether or not a normal answer has been obtained.
For example, a mutual monitoring method among a plurality of data processing devices, which is a method for mutually monitoring whether or not a plurality of data processing devices functions normally, has already been proposed (e.g., refer to Japanese Patent Laid-Open No. 2001-350735); the mutual monitoring method is characterized in that a plurality of question codes is prepared; a first data processing device sends a second data processing device any one of the plurality of question codes; the second data processing device performs a predetermined calculation that has been preliminarily determined in accordance with the received question code and sends the actual calculation result to the first data processing device; and then the operations of the first and the second data processing device are monitored, based on the result of determination on whether or not the first data processing device has been able to receive the actual calculation result within a predetermined time period and the result of comparison between the content of the actual calculation result and a correct-solution calculation result that has been prepared in accordance with the received question code.
In the conventional method disclosed in Japanese Patent Laid-Open No. 2001-350735, the foregoing question code denotes a question number; letting N denote the question number, the calculation to be performed by the second data processing device is defined as [N+25+27+29+(N*210)+214+215]. As described above, the calculated data includes N; the correct-solution information corresponding to the question number is preliminarily stored as known information in the first data processing device. The conventional apparatus disclosed in Japanese Patent Laid-Open No. 2001-350735 is configured in such a way that the value of an error counter is increased or decreased, depending on whether or not the actual calculation result has been obtained within the predetermined time period and whether or not the actual calculation result has been correct, and a predetermined command is outputted when the value of the error counter exceeds a predetermined value.
Moreover, as another conventional apparatus, an electronic control apparatus incorporating a microprocessor, which periodically and alternatively implements part of a control program so as to perform an operation inspection while the engine is running, has been disclosed (e.g., refer to Japanese Patent Laid-Open No. 2005-31865), in which a monitoring control circuit unit sequentially transmits, through an inquiry packet, a great number of question items to a microprocessor that controls a group of electric loads in response to the contents of a nonvolatile program memory and the operation status of a group of input sensors, and compares the content of the reply from the microprocessor with correct-solution information so as to perform an abnormality determination, and the microprocessor diagnoses the cycle of reception of the inquiry packets so as to counter-monitor the monitoring operation of the monitoring control circuit unit.
The outline of the Q&A-method abnormality determination unit set forth with regard to the conventional apparatus disclosed in Japanese Patent Laid-Open No. 2005-31865 is as illustrated in FIG. 14. In FIG. 14, an electronic control apparatus 1 is configured with a main control circuit unit 2 incorporating a microprocessor 2a and a monitoring control circuit unit 3 serially connected to the main control circuit unit 2. The main control circuit unit 2 is configured in such a way as to respond to the operation statuses of a great number of input signals including input signals A, B, and C and output a great number of output signals including an output signal Y so as to drive and control the electric loads; the main control circuit unit 2 is configured in such a way that the control specification thereof is determined by the contents of a program memory 2b that collaborates with the microprocessor 2a. 
For example, a monitoring subject program 2c is configured in such a way as to calculate the output signal Y [=K×(A−B)+C], based on the input signals A, B, and C and a control constant K that is preliminarily stored in the program memory 2b. Simulated-calculation data 2f is stored in the program memory 2b; a table n that typifies data tables 1, 2, - - - , n in the simulated-calculation data 2f is configured with simulation constants An, Bn, and Cn corresponding to the control constant K and the input signals A, B, and C; however, the electronic control apparatus 1 is configured in such a way that the table to be utilized for the simulated calculation is randomly designated in an updating manner, in accordance with question information from the monitoring control circuit unit 3.
The electronic control apparatus 1 is configured in such a way that, for the monitoring subject program 2c, an input information switching unit 2d periodically designates the data table n instead of the input signal A, B, and C, and the calculation result Yn [=K×(An−Bn)+Cn] is periodically transmitted, as answer information, to the monitoring control circuit unit 3 by way of an output destination switching unit 2e. The electronic control apparatus 1 is configured in such a way that the correct-solution information corresponding to question information (a data table number for simulated calculation) is preliminarily stored in the monitoring control circuit unit 3, and an abnormality determination unit 3a compares the answer information obtained from the main control circuit unit 2 with the correct-solution information so as to determine whether or not an abnormality exists. In addition, as the control program for performing the simulated calculation utilizing the data table, the monitoring subject program 2c may directly be utilized, or a copy program 2g, which is the monitoring subject program 2c written in a different address region of the program memory 2b, may be utilized.
In the conventional mutual monitoring method disclosed in Japanese Patent Laid-Open No. 2001-350735, no method for data communication between the first and second processing devices is described. Moreover, the calculation equation for the simulated calculation is not related to input and output control; therefore, neither input and output control timing nor communication timing is taken into account. Still moreover, in the conventional electronic control apparatus disclosed in Japanese Patent Laid-Open No. 2005-31865, because, for the communication with the monitoring control circuit unit, start-stop synchronization method (asynchronous communication method) is adopted in which transmission and reception are performed in steps of several bits and input and output monitoring information and Q&A information are each transmitted and received in a divided manner at appropriate timings; therefore, the cycles of the transmission and reception of the input and output monitoring information and the cycles of the transmission and reception of the Q&A information can arbitrarily be changed. However, it has been a problem that, for the transmission data and the reception data, address information for designating the storage destination of the data and command information for discriminating the contents of the transmission data and the reception data are required, whereby the amounts of the transmission data and the reception data increase and the start-stop synchronization method is not suitable for high-speed communication.